Turkey Spotlight

CASP framework

Turkey moved from a 2021 payment ban to a full licensing regime in just three years — and built the most technically prescriptive crypto-security bar of any major market. This view traces that lineage, shows what inspired each step, and maps every requirement to where CertiK can help.

Opportunity56.8
Data confidenceMedium56

The opportunity score blends deadline urgency, applicable-service breadth and market maturity at the jurisdiction level. The CASP licensing regime detailed below is established by Law 7518 — which is why the framework reads as "Licensing" even where the aggregate jurisdiction record is still catching up.

Lead framework
Law 7518
CASP licensing
Current regime
Licensing
Status
Implementing
Norms tracked
62
62 total
Market maturity
Medium

The TÜBİTAK bar: a now-live, state-grade security standard

Turkey is the only major jurisdiction to route crypto-platform licensing through a national cybersecurity laboratory. Under Law 7518 Art. 35/B(2), the IT-systems criteria for a CASP licence are set by TÜBİTAK BİLGEM, and Art. 99/B(2) makes an independent IT-systems audit mandatory. This is no longer a pending framework: SPK Communiqués III-35/B.1 and III-35/B.2 — covering establishment, operating principles and capital adequacy — entered into force in March 2025, and TÜBİTAK BİLGEM technical guidelines set concrete controls: FIPS 140-3 / ISO-19790 Level-3 HSMs (Level 2 is insufficient), cold-wallet dominance, MPC / multi-signature custody with at least one key share in a certified HSM, keys generated inside a secure element and never extracted, and in-country hosting of critical infrastructure. The platform-revenue levy under Art. 130(5) — 1% to the SPK and 1% to TÜBİTAK — funds the regulator's technical capacity and began in 2025 on 2024 revenue.

Sources: Law No. 7518 (Arts. 35/B(2), 99/B(2), 130(5)); SPK Communiqués III-35/B.1 & III-35/B.2 (in force March 2025); CertiK, "Turkey's CASP Framework: The TÜBİTAK Edge" (June 2026).

How the regulation evolved

From an AML backbone to a licensed, audited CASP regime.

  1. 2006

    AML Law No. 5549

    nullRegistrationIn force

    Turkey's anti-money-laundering backbone. Defines obligated parties, customer identification and suspicious-transaction reporting — the duties Law 7518 later extends to crypto-asset platforms via Art. 35/C(1).

    From the source:ARTICLE 29 – (1) This Law shall enter into force on the date of its publication.
    Modelled onEU · 5AMLD · 2018FATF Recommendations · 2025
    TR-AMLLAW5549-2006· view source
  2. 2013

    Payment & E-Money Law No. 6493

    nullLicensingIn force

    Authorisation regime for payment and e-money institutions, modelled on the EU's PSD2 and EMD2. Becomes the legal hook for the 2021 crypto-payment ban.

    From the source:Published in the Official Gazette: Date: 27/6/2013 Issue: 28690
    Modelled onEU · PSD2 · 2015EU · EMD2 · 2009FATF Recommendations · 2025
    TR-PAYLAW6493· view source
  3. 2021

    TCMB Crypto-Payment Ban

    TCMBProhibitionIn force

    Prohibits using crypto-assets — directly or indirectly — in payments, and bars payment / e-money institutions from intermediating fund transfers to crypto platforms. A containment measure, not a licensing regime.

    From the source:Bu Yönetmelik 30/4/2021 tarihinde yürürlüğe girer.
    TR-TCMBPAYBAN-2021· view source
  4. 2024

    Law No. 7518 — CASP Framework

    nullLicensingImplementing

    Amends the Capital Markets Law to license crypto-asset service providers under the SPK. Introduces the licensing IT-systems bar (Art. 35/B(2)), mandatory independent IT-systems audit (Art. 99/B(2)), client-asset segregation (Art. 35/C(6)-(7)) and the Travel Rule (Art. 35/C(5)).

    From the source:Bu Kanunun 35/B ve 35/C maddeleri uyarınca çıkarılacak ikincil düzenlemeler, bu maddenin yürürlüğe girdiği tarihten itibaren altı ay içinde yürürlüğe konulur.
    Modelled onEU · MiCA · 2023FATF Recommendations · 2025
    TR-LAW7518-2024· view source
  5. 2025

    MASAK Travel Rule & SPK Communiqués

    MASAKLicensingImplementing

    Operationalises Law 7518. MASAK's Travel Rule Guidelines take effect on 25 February 2025, extending originator/beneficiary data duties to crypto-asset transfers; SPK Communiqués III-35/B.1 and III-35/B.2 (establishment, operating principles, capital adequacy) enter into force in March 2025; and TÜBİTAK BİLGEM technical guidelines set the security bar for licensing.

    From the source:5549 sayılı Suç Gelirlerinin Aklanmasının Önlenmesi Hakkında Kanun, 6362 sayılı Sermaye Piyasası Kanunu ve ilgili mevzuat çerçevesinde kripto varlık hizmet sağlayıcıların (KVHS) yükümlülüklerine açıklık getirmek amacıyla hazırlanan “Kripto Varlık Hizmet Sağlayıcılar Rehberi” güncellenerek yayımlanmıştır.
    Modelled onFATF Recommendations · 2025EU · MiCA · 2023
    TR-MASAKTRAVEL-2025· view source

What inspired it

Turkey's framework is a deliberate synthesis of EU and FATF standards, grafted onto its own financial-law backbone.

Modelled on the world

International frameworks Turkey's marquee laws were built on. These links are curated from the statutes' own references — the anchor frameworks are not seeded as graph nodes, so they do not appear in the live graph.

  • AML Law No. 5549
    → EU · 5AMLD (2018)
  • AML Law No. 5549
    → FATF Recommendations (2025)
  • Payment & E-Money Law No. 6493
    → EU · PSD2 (2015)
  • Payment & E-Money Law No. 6493
    → EU · EMD2 (2009)
  • Payment & E-Money Law No. 6493
    → FATF Recommendations (2025)
  • Law No. 7518 — CASP Framework
    → EU · MiCA (2023)
  • Law No. 7518 — CASP Framework
    → FATF Recommendations (2025)
  • MASAK Travel Rule & SPK Communiqués
    → FATF Recommendations (2025)
  • MASAK Travel Rule & SPK Communiqués
    → EU · MiCA (2023)

Domestic legal foundations

The Turkish statutes the CASP regime leans on, read live from the regulatory graph. Curated to the laws that matter for crypto and verified against real citation edges — the long tail of generic statute references is filtered out.

  • Capital Markets Law No. 6362

    The statute Law 7518 amends — CASPs are licensed and supervised as capital-market institutions under the SPK.

    Cited byLaw 7518Payment Law 6493MASAK Travel Rule
  • AML Law No. 5549

    Source of the KYC, customer-due-diligence and suspicious-transaction duties CASPs inherit through MASAK.

    Cited byLaw 7518MASAK Travel Rule
  • Banking Law No. 5411

    Client cash and crypto are custodied through BDDK-regulated banks named by the SPK.

    Cited byLaw 7518Payment Law 6493
  • Anti-Terror Law No. 3713

    Counter-financing-of-terrorism duties that extend to crypto-asset transfers.

    Cited byLaw 7518
  • Proliferation-Financing Law No. 7262

    Targeted financial sanctions and proliferation-financing controls applied to CASPs.

    Cited byLaw 7518
  • Turkish Penal Code No. 5237

    Underlies the market-manipulation and fraud offences the CASP regime enforces.

    Cited byLaw 7518
Explore the full regulatory graph →

What the TÜBİTAK bar actually demands

Concrete technical controls a CASP must meet — and where CertiK maps.

Certified hardware security modules

Key material must sit in FIPS 140-3 / ISO-19790 Level-3 HSMs. Level-2 modules are explicitly insufficient.

TÜBİTAK BİLGEM guidelines · Art. 35/B(2)
Independent CertificationSecurity Guidance
Cold-wallet dominance

The bulk of client assets must be held in cold storage, with hot-wallet exposure tightly bounded.

TÜBİTAK BİLGEM guidelines · Art. 35/C(6)-(7)
Proof of ReservesSkynet — Threat Monitoring
MPC / multi-signature custody

Withdrawals require multi-party computation or multi-signature, with at least one key share held inside a certified HSM.

TÜBİTAK BİLGEM guidelines
Smart Contract AuditIndependent Certification
Key integrity in a secure element

Private keys are generated inside a secure element and must never be exported in clear.

TÜBİTAK BİLGEM guidelines
Penetration TestingSecurity Guidance
In-country critical infrastructure

Systems handling client assets and order flow must be hosted domestically, within Turkish jurisdiction.

TÜBİTAK BİLGEM guidelines · Law 7518
Regulatory Compliance SupportSecurity Guidance
DLT-integration controls

Controls governing how the platform integrates with distributed-ledger networks (node, bridge and settlement security).

Law 7518 Art. 26
L1 Chain AuditSmart Contract Audit
Mandatory independent IT-systems audit

An SPK-listed independent audit firm must audit the platform's IT systems; procedures are set by the SPK after a TÜBİTAK opinion.

Law 7518 Art. 99/B(2)
Penetration TestingL1 Chain AuditIndependent Certification

Requirements → CertiK services

Each obligation Turkey's text imposes, and the CertiK service that answers it.

  • RequiredIndependent IT-systems audit
    Law 7518 Art. 99/B(2)
    L1 Chain AuditSmart Contract AuditPenetration Testing
  • RequiredIndependent certification (licensing IT bar)
    Law 7518 Art. 35/B(2) — TÜBİTAK criteria
    Independent CertificationSecurity Guidance
  • RequiredKYC / AML & Travel Rule
    Law 7518 Art. 35/C(1) & 35/C(5)
    SkyInsights — AML / KYTRegulatory Compliance Support
  • RequiredClient-asset custody & segregation
    Law 7518 Art. 35/C(6)-(7)
    Proof of ReservesSkynet — Threat Monitoring
  • RequiredProof of reserves
    Law 7518 Art. 35/C(6)-(7)
    Proof of Reserves
  • Not flaggedPenetration testing
    Law 7518 Art. 35/B(2) — IT-systems security
    Penetration Testing
  • Not flaggedFormal verification
    Law 7518 Art. 35/B(2)
    Formal Verification

The exploitable gap

Law 7518 delegates the hard technical criteria to forthcoming secondary regulation — the precise space an independent certifier fills.

The law delegates the specific technical criteria for licensing and asset listing to future regulations by the Capital Markets Board, based on input from TÜBİTAK. This creates an opportunity for certifiers to provide services based on these forthcoming technical standards.

Law No. 7518, transitional provision:Bu Kanunun 35/B ve 35/C maddeleri uyarınca çıkarılacak ikincil düzenlemeler, bu maddenin yürürlüğe girdiği tarihten itibaren altı ay içinde yürürlüğe konulur.
Where CertiK fills it
Independent CertificationSecurity GuidanceRegulatory Compliance Support
Read Law No. 7518 (Resmî Gazete) →

Aligned with the frameworks it was modelled on

Where Turkey's Law 7518 matches MiCA and the FATF standard — grounded article by article.

DimensionTürkiye (Law 7518)EU · MiCAFATF
Licensing regime for CASPs
Art. 35/B(1)
YesYesPartial
Recommends, does not license
IT-systems criteria set by a state technical body
Art. 35/B(2) — TÜBİTAK
Yes
TÜBİTAK BİLGEM
Partial
DORA resilience, no state lab
No
Mandatory independent IT-systems audit
Art. 99/B(2)
YesPartialNo
KYC / customer due diligence
Art. 35/C(1) — Law 5549
YesYesYes
Travel Rule (originator / beneficiary data)
Art. 35/C(5)
YesYesYes
Recommendation 16
Market-abuse surveillance
Art. 35/C(3) — Art. 104
YesYesNo
Client-asset segregation / custody
Art. 35/C(6)-(7)
Yes
BDDK-approved banks, bankruptcy-remote
YesPartial
Crypto excluded from investor compensation
Art. 35/C(4) — Art. 82
Yes
Explicit exclusion
PartialNo

How Turkey compares to the world

Technical-security prescriptiveness across the major regimes.

RegimeApproachAdvantageTrade-off
Türkiye
SPK + TÜBİTAK BİLGEM
Licensing gated by a national cybersecurity lab; prescriptive, state-grade controls (HSM level, custody architecture, local hosting).Highest technical-security floor of any major regime; little ambiguity about what secure means.Heavy compliance lift; prescriptive controls can lag fast-moving technology.
Hong Kong
SFC
Licensing with detailed custody and security expectations, assessed case-by-case by the regulator.Mature, well-understood process; strong custody emphasis.Less explicit on hardware-level cryptographic standards.
European Union
ESMA / EBA (MiCA + DORA)
Harmonised licensing (MiCA) plus operational-resilience rules (DORA); principles- and risk-based rather than device-prescriptive.Single-market passport; broad, consistent coverage.Technical-security expectations are outcome-based, leaving the how to firms.
Dubai
VARA
Activity-based licensing with dedicated rulebooks; security expectations set per activity.Crypto-native, fast-moving regulator.Younger regime; less prescriptive on cryptographic hardware.
Other markets
Various
Registration or AML-only regimes with limited technical-security mandates.Low barrier to entry.Weak assurance; security largely left to the platform.

Source: CertiK, "Turkey's CASP Framework: The TÜBİTAK Edge" (June 2026).

Turkey's regulatory DNA

How rare each requirement is across the 23 tracked jurisdictions. Turkey's signature is that it mandates the scarce, technical controls most regimes never ask for.

RequirementTürkiyeGlobal adoptionRarity
Formal verificationNot required
0/23
Unused
Penetration testingNot required
2/23
Signature
Technical auditRequired
8/23
Signature
Independent certificationRequired
9/23
Signature
Proof of reservesRequired
11/23
Common
Custody securityRequired
16/23
Common
AML / KYTRequired
21/23
Table-stakes

"Signature" = required by fewer than half of the tracked jurisdictions. Adoption counts read live from the corpus.

Closest regulatory peers

Ranked by rarity-weighted overlap — sharing a scarce control (independent audit, certification) counts for far more than sharing table-stakes KYC.

  • Argentina89%
    Technical auditIndependent certificationProof of reservesCustody securityCustodyTaxation
  • United Kingdom86%
    Technical auditIndependent certificationProof of reservesToken issuanceCustody securityCustody
  • Hong Kong86%
    Technical auditIndependent certificationProof of reservesToken issuanceCustody securityCustody
  • United Arab Emirates80%
    Technical auditIndependent certificationProof of reservesToken issuanceCustody securityCustody
  • Singapore66%
    Independent certificationProof of reservesToken issuanceCustody securityCustodyTaxation
  • United States66%
    Independent certificationProof of reservesCustody securityCustodyTaxationAML / KYT

Underlying norms

62 Turkish norms in the corpus that ground this view.

Data confidence & caveats

Confidence components
  • Analysis coverage: 21%
  • Coverage breadth: 67%
  • Regulator diversity: 88%
  • Evidence density: 74%
Caveats
  • International lineage (MiCA, PSD2, EMD2, 5AMLD, FATF) is curated from the statutes' own references; these anchors are not seeded as graph nodes.
  • Article citations are taken from the Turkish text of Law No. 7518; auto-translated bodies are for orientation only.
  • Technical mandates reflect TÜBİTAK BİLGEM guidance and SPK Communiqués in force as of March 2025.